popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

bin.exe

Generic Malware .NET framework(MSIL) Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check JPEG Format PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 19, 2024, 9:54 a.m. June 19, 2024, 9:57 a.m.
Size 424.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 13e5872e9b7c47090e035dc228c5589f
SHA256 d6cfb9d6c862be5a244eb5e4c6339312f74b7eb57cad8d08f56e3de0024b2bbc
CRC32 A1AC4AF1
ssdeep 6144:9O1rkNbOFsBuztTfSoRgxX+j14TGYoij7aR1XPQg9TU5YGmvST3h68BoKupOdCHP:3xBuBTExX+AoLzTUKdvST/BoKupOjUz
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
pool.hashvault.pro
A 131.153.76.130
A 125.253.92.50
142.202.242.43
o7labs.top
A 91.92.240.234
91.92.240.234
IP Address Status Action
125.253.92.50 Active Moloch
164.124.101.2 Active Moloch
91.92.240.234 Active Moloch
91.92.244.178 Active Moloch
47.76.164.119 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 91.92.240.234:80 -> 192.168.56.103:49165 2400012 ET DROP Spamhaus DROP Listed Traffic Inbound group 13 Misc Attack
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2023883 ET DNS Query to a *.top domain - Likely Hostile Potentially Bad Traffic
TCP 192.168.56.103:49164 -> 91.92.240.234:80 2023882 ET INFO HTTP Request to a *.top domain Potentially Bad Traffic
TCP 192.168.56.103:49166 -> 91.92.240.234:80 2022896 ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 A Network Trojan was detected
TCP 192.168.56.103:49172 -> 125.253.92.50:80 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation
TCP 192.168.56.103:49165 -> 91.92.240.234:80 2044597 ET MALWARE Amadey Bot Activity (POST) M1 A Network Trojan was detected
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2014819 ET INFO Packed Executable Download Misc activity
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2018959 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2016538 ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download Potentially Bad Traffic
TCP 91.92.240.234:80 -> 192.168.56.103:49166 2023464 ET HUNTING Possible EXE Download From Suspicious TLD Misc activity
TCP 192.168.56.103:49166 -> 91.92.240.234:80 2022896 ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 A Network Trojan was detected
UDP 192.168.56.103:50800 -> 164.124.101.2:53 2036289 ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) Crypto Currency Mining Activity Detected
TCP 192.168.56.103:49165 -> 91.92.240.234:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 192.168.56.103:49165 -> 91.92.240.234:80 2044696 ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 A Network Trojan was detected
TCP 91.92.244.178:9345 -> 192.168.56.103:49170 2400012 ET DROP Spamhaus DROP Listed Traffic Inbound group 13 Misc Attack
TCP 192.168.56.103:49172 -> 125.253.92.50:80 2024792 ET POLICY Cryptocurrency Miner Checkin Potential Corporate Privacy Violation

Suricata TLS

No Suricata TLS

suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://o7labs.top/visual/skins/index.php
suspicious_features POST method with no referer header, POST method with no useragent header suspicious_request POST http://o7labs.top/visual/skins/index.php?scr=1
suspicious_features GET method with no useragent header suspicious_request GET http://o7labs.top/visual/blob.exe
suspicious_features GET method with no useragent header suspicious_request GET http://o7labs.top/visual/build.exe
request POST http://o7labs.top/visual/skins/index.php
request POST http://o7labs.top/visual/skins/index.php?scr=1
request GET http://o7labs.top/visual/blob.exe
request GET http://o7labs.top/visual/build.exe
request POST http://o7labs.top/visual/skins/index.php
request POST http://o7labs.top/visual/skins/index.php?scr=1
domain o7labs.top description Generic top level domain TLD
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1508
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004b60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
description Hkbsse.exe tried to sleep 122 seconds, actually delayed analysis time by 122 seconds
file C:\Users\test22\AppData\Local\Temp\1000001001\blob.exe
file C:\Users\test22\AppData\Local\Temp\1000003001\build.exe
file C:\Users\test22\AppData\Local\Temp\5641a448ac\Hkbsse.exe
file C:\Users\test22\AppData\Local\Temp\1000001001\blob.exe
file C:\Users\test22\AppData\Local\Temp\1000003001\build.exe
file C:\Users\test22\AppData\Local\Temp\1000003001\build.exe
file C:\Users\test22\AppData\Local\Temp\5641a448ac\Hkbsse.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\5641a448ac\Hkbsse.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\5641a448ac\Hkbsse.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000001001\blob.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000001001\blob.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\1000003001\build.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\1000003001\build.exe
1 1 0
Time & API Arguments Status Return Repeated

InternetReadFile

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEd†dmofð" n\'@@0(`p‘<ð't (x €(„8“X.textöln `.rdata €r@@.data°D' :'Œ@À.pdatatð'Æ'@@.00cfg(È'@@.tls(Ê'@À.relocx (Ì'@BVHƒì H‹pÇH‹pÇH‹pÇH‹ Õo·1ÀúMZuKHcQ<<PEu>HÑ·Qú tú u'ƒytr!HÁè냹„rHÁø1Àƒ9•ÀH‹ Žoƒ9‰ñÈ'¹ƒÙè¸jH‹Ùo‹0è ‰0H‹¹o‹0èê‰0èƒH‹,oƒ8u H è 1ÀHƒÄ ^ÃHƒì(H‹•o‹‰È'H†È'H‹ ooD‹ H‰D$ H tÈ'HqÈ'LrÈ'èjHƒÄ(ÀHƒì(H‹ÕnÇè HƒÄ(ÃfAWAVVWSHƒì eH‹%0H‹xH‹5Én1ÀðH±>”Ãt.H9Çt)L‹5¡‚f„¹èAÿÖ1ÀðH±>”ÃtH9ÇuçH‹=n‹ƒøu ¹èŸië'ƒ?t ÆÉÇ'ëÇH‹ znH‹{nè–i‹ƒøuH‹ PnH‹Qnè|iÇ„Ût1ÀH‡H‹æmH‹H…Àt1ɺE1ÀÿÆí'è9H  ÿ܁H‹ åmH‰H +è& èHc=Ç'H ýè=iH‰ÆH…ÿ~G‰ûL‹5Ç'E1ÿf„K‹ þè7iHxH‰ùè iJ‰þK‹þH‰ÁI‰øèiIÿÇL9ûuÐë1ÛHÇÞH‰5µÆ'èØH‹±Æ'H‹ "mH‹ H‰‹ ’Æ'H‹Æ'L‹Æ'è«%‰‘Æ'ƒ=jÆ't €=}Æ'u èNh‹tÆ'HƒÄ [_^A^A_ÉÁèehÌ@Hƒì(H‹ÅlÇèúýÿÿHƒÄ(ÃfHƒì(è'h1ÉHƒøɉÈHƒÄ(ÄÃÌÌÌXH‰L$H‰T$L‰D$L‰L$ Hƒì(‹ MŒè(c‰NŒH1ÉèÊeH‰CŒH1À‹6ŒHƒÄ(H‹L$H‹T$L‹D$L‹L$ I‰Ê ŒÿŒÿ5ŒÃÇò‹’Ýã4èÿÿÿÇã‹H:µèrÿÿÿÇԋNuÞècÿÿÿÇŋ…5ª–èTÿÿÿǶ‹‘-èEÿÿÿǧ‹ˆi8ôè6ÿÿÿǘ‹1睄è'ÿÿÿlj‹ãD¨èÿÿÿÇz‹n”êaè ÿÿÿÇk‹±ª#èúþÿÿÇ\‹À£l&èëþÿÿÇM‹f} èÜþÿÿÇ>‹Ñ/ÖÿèÍþÿÿÇ/‹¦è¾þÿÿÇ ‹Sôuhè¯þÿÿÇ‹çE6è þÿÿÇ‹"+Ôè‘þÿÿÇóŠóÄJ è‚þÿÿÇäŠå%‘ÝèsþÿÿÇՊ¾saèdþÿÿÇƊ¢8÷èUþÿÿÇ·ŠV>¸èFþÿÿǨŠ/¿öùè7þÿÿÇ™Šµ$“¶è(þÿÿÇŠŠ‡Ä7ŽèþÿÿÇ{ŠFʔè þÿÿÇlŠãža.èûýÿÿÇ]ŠW>èìýÿÿÇNŠ×íÞPèÝýÿÿÇ?ŠVŽk»èÎýÿÿÇ0Š¢~ñ£è¿ýÿÿÇ!Š}çãè°ýÿÿÇŠ£qø±è¡ýÿÿÌÌÌÌÌÌÌÌÌÌÌÌÌHƒì(H‹ ŠH‹H…Àt.ffff.„ÿâé'H‹ë‰HHH‰ à‰H‹@H…ÀußHƒÄ(Ãf.„VWSHƒì H‹5:j‹ƒøÿu¸ÿÿÿÿfDHÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹Dþÿmé'Hÿ˅ÿH‰ßuëH TÿÿÿHƒÄ [_^é¸üÿÿ„VWSHƒì €=âÂ'tHƒÄ [_^ÃÆÑÂ'H‹5²i‹ƒøÿu¸ÿÿÿÿfffff.„HÿÀHƒ<Îuô…Àt%‰ÇHÿÏH‰û„H‹DþÿÝè'Hÿ˅ÿH‰ßuëH ÄþÿÿHƒÄ [_^é(üÿÿÌÌÌÌÌÌÌÌ1ÀÃÌÌÌÌÌÌÌÌÌÌÌÌÌVWHƒì(H‹ciƒ8tǃút<ƒúuAH5‡yH=€yH9÷uë,f„HƒÇH9þtH‹H…ÀtïÿQè'ëçºè ¸HƒÄ(_^Ð1ÀÃffff.„Hƒì(ƒút…Òuèî¸HƒÄ(ÃÌÌÌÌVWHƒì8H‰Î‹ÿȃøwH˜H ÑiHc<HÏëH=†i¹è[ L‹NFòN òL$0D$ HkiH‰ÁI‰øèÑc1ÀHƒÄ8_^ÃÌÌÌÌÌÌÌÌÛãÃÌÌÌÌÌÌÌÌÌÌÌÌÌUAWAVAUATVWSHƒìHl$€=LÁ'…mÆ?Á'Hƒì èn HƒÄ H˜H€HÅHƒàðè“ H)ÄH‰àH‰Á'ÇÁ'H‹=ÅjH‰øH+ÃjHƒøŽH‹²jH‰øH)ØHƒø |,H‹Ÿjƒ;u/H‹“jƒ{u"H‹†jHX ƒxHE؃;u ƒ{„ÓH;\jsHL‹5«fHuffffff.„‹‹KB1Lñ‰EHƒì A¸H‰òèHƒÄ HƒÃH9ûrҋTÀ'…À~g¿H‹<À'1ÛHuøL‹5‡zëffff.„HÿÃHcÈHƒÇ(H9Ë}0D‹D:ðE…ÀtçH‹L:øH‹:Hƒì I‰ñAÿÖHƒÄ H‹é¿'‹ë¿'ëÁHe[_^A\A]A^A_]ËSƒú…[HƒÃ H;yiƒaÿÿÿL‹5ÄeL=½gA¼‹HuøI½ÿÿÿÿëffffff.„HƒÃ H9ûƒ!ÿÿÿ‹KA‰ÈAàøAƒÀøA¬ÈAƒø‡×‹‹CLðN‹ 2Oc‡MúAÿâD¶M“ÿÿÿE„ÛëD·M“ÿÿfE…Ûë D‹O+E…ÛMIÓëL‹LòI)ÒMÊL‰Uø¶Ñƒú?w&IÇÃÿÿÿÿ‰ÑIÓãI÷ÓM9ÚLJÿIÇÃÿÿÿÿIÓãM9Ú|:Aƒø‡DÿÿÿE£Äƒ:ÿÿÿIcÈH0hL‹ÊHƒì H‰ÁH‰òèMHƒÄ éÿÿÿHƒì0L‰T$ H gI‰Àè̶ÑHƒì H Øfè¹Hƒì H –fè©Ì„AWAVATVWSHƒìXL‰ÇH‰ÓH‰ÎD‹=;¾'E…ÿ~GH‹'¾'J ýH ‰1Òë€HƒÂ(H9Ñt#L‹DI9ðwíL‹L E‹IMÈI
request_handle: 0x00cc000c
1 1 0

InternetReadFile

 buffer: MZÿÿ¸@€º´ Í!¸LÍ!This program cannot be run in DOS mode. $PEL ôqfà 0Þ°Îü @ à@…|üO®À  H.textÔÜ Þ `.rsrc®®à@@.reloc ÀŽ@B°üH`O­(À>˜Å0(û**0; %¢ y( o Ð( o ( (#t*0; %¢ ‘y( o Ð( o ( (#t*0; %¢ Åy( o Ð( o ( (#t*0? %¢%¢ ¯y( o Ð( o ( (#t*0; %¢ šy( o Ð( o ( (#t*0 %¢ Yy(#t€*0; %¢ …y( o Ð( o ( (#t*0+ %¢%¢%Œ¢ y(#t*0; %¢ ï+y( o Ð( o ( (#t*0z+¾Í(ê 89o 88¥Q(êa+E[(êa+,(êa8)XE:8õ*(L+É(êô+».YE.@ú+Ÿ+5XE/BSe8iÿÿÿ1(L8Wÿÿÿ8Dÿÿÿo â84ÿÿÿ(êþ á8!ÿÿÿ,#2(L8ÿÿÿ(êX à8þþÿÿ++- +Fo (êþ,$+æì?¾þÿÿ+*?òþÿÿ+ ¶?ÿÿÿ++:©þÿÿ + *2+¾Ë( *0, ª+y( o ( o ( (#t*0, ây( o ( o ( (#t*0, e*y( o ( o ( (#t*0, Ç*y( o ( o ( (#t*0, •*y( o ( o ( (#t*0, «*y( o ( o ( (#t*0 y%y(#t€*0 %y(#&*2+ª­( *0 %¢ (%y(#t*07 %¢ ô%y( o ( o ( (#¥¶*07 %¢ €%y( o ( o ( (#¥¶*07 %¢ L$y( o ( o ( (#¥¶*07 %¢ 1*y( o ( o ( (#¥¶*07 %¢ ±úy( o ( o ( (#¥¶*07 %¢ Cáy( o ( o ( (#¥¶*0 %¢ Ú¡y(#¥¶*00 ¬´y( o Ð( o ( (#t*0; %¢ M°y( o Ð( o ( (#t*0 %¢ ¸Ìy(#t–*2+½¯( *0; %¢ ÄËy( o Ð( o ( (#t*0; %¢ AÙy( o Ð( o ( (#t*0; %¢ Õy( o Ð( o ( (#t*0 %¢ Ñ×y(#t*0 %¢ “Ñy(#t*0 %¢ žæy(#t*0; %¢ ɺy( o Ð( o ( (#t*0 ·æy(#&*2+®°( *0 %¢ áy(#t*0< %Œ ¢ Íáy( o ( o ( (#¥¶*0< %Œ ¢ ãáy( o ( o ( (#t*0< %Œ ¢ Wày( o ( o ( (#¥¶*0< %Œ ¢ eày( o ( o ( (#t*0< %Œ ¢ Aãy( o ( o ( (#¥¶*0< %Œ ¢ ãy( o ( o ( (#t*00 ¿øy( o Ð ( o ( (#t*2+Í«( *0 Rûy(#¥¶*0 %¢ åúy(#¥¶*0 &y(#tƒ*0³rp s % ÿÿÿjo % ÿÿÿjo %#>@( o %#>@( o %#>@( o %#>@( o %o %s % f ¨o % ÿÿÿo % ÿÿÿo % ÿÿÿo % ÿÿÿo o %s %s %o o o o o!
request_handle: 0x00cc000c
1 1 0
host 91.92.244.178
host 47.76.164.119
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\blob.exe reg_value C:\Users\test22\AppData\Local\Temp\1000001001\blob.exe
file C:\Windows\Tasks\Hkbsse.job
Lionic Trojan.Win32.Deyma.a!c
Elastic Windows.Generic.Threat
Cynet Malicious (score: 100)
CAT-QuickHeal Trojandownloader.Deyma
Skyhigh BehavesLike.Win32.Generic.gh
ALYac Gen:Variant.Zusy.552096
Cylance Unsafe
VIPRE Gen:Variant.Zusy.552096
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 0057994f1 )
BitDefender Gen:Variant.Zusy.552096
K7GW Trojan-Downloader ( 0057994f1 )
Cybereason malicious.e9b7c4
Arcabit Trojan.Zusy.D86CA0
Baidu Win32.Trojan.Delf.in
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
McAfee Artemis!13E5872E9B7C
Avast Win32:BotX-gen [Trj]
Kaspersky HEUR:Trojan-Downloader.Win32.Deyma.gen
Alibaba TrojanDownloader:Win32/Deyma.e70d6283
NANO-Antivirus Trojan.Win32.Redcap.koqimc
MicroWorld-eScan Gen:Variant.Zusy.552096
Rising Spyware.Agent!8.C6 (TFE:5:5qH3vzGUSkV)
Emsisoft Gen:Variant.Zusy.552096 (B)
F-Secure Trojan.TR/Redcap.blcoe
DrWeb Trojan.DownLoader47.3915
TrendMicro Trojan.Win32.AMADEY.YXEFQZ
McAfeeD Real Protect-LS!13E5872E9B7C
Trapmine malicious.high.ml.score
FireEye Generic.mg.13e5872e9b7c4709
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Redcap.blcoe
MAX malware (ai score=87)
Antiy-AVL Trojan[Downloader]/Win32.Deyma
Kingsoft malware.kb.a.988
Gridinsoft Trojan.Win32.Downloader.ca
Microsoft Trojan:Win32/Casdet!rfn
ZoneAlarm HEUR:Trojan-Downloader.Win32.Deyma.gen
GData Gen:Variant.Zusy.552096
Varist W32/Agent.HSX.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R653644
BitDefenderTheta Gen:NN.ZexaF.36806.AuW@aOikWCoi
DeepInstinct MALICIOUS
VBA32 BScope.TrojanDownloader.Deyma
Malwarebytes Trojan.Amadey